System and method for ai based incident impact and root cause analysis

Abstract

A system and method for reducing data record processing in incident report generation is provided. The method includes: accessing a plurality of event records, each event record generated based on an event in a computing environment; parsing each event record based on a predetermined data field; extracting from each predetermined data field a data value; correlating a group of event records of the plurality of event records based on at least an extracted data value; generating an incident data record based on the extracted data values of the correlated group of event records; generating a prompt based on the incident data record; and generating an incident report by configuring a large language model (LLM) to execute the generated prompt.

What is claimed is: 
     
         1 . A method for reducing data record processing in incident report generation, comprising:
 accessing a plurality of event records, each event record generated based on an event in a computing environment;   parsing each event record based on a predetermined data field;   extracting from each predetermined data field a data value;   correlating a group of event records of the plurality of event records based on at least an extracted data value;   generating an incident data record based on the extracted data values of the correlated group of event records;   generating a prompt based on the incident data record; and   generating an incident report by configuring a large language model (LLM) to execute the generated prompt.   
     
     
         2 . The method of  claim 1 , further comprising:
 generating the prompt further based on the incident data record and context data of a data source, wherein the data source generated a portion of the correlated group of event records.   
     
     
         3 . The method of  claim 1 , further comprising:
 storing in the incident data record only the extracted data values of the correlated group of event records.   
     
     
         4 . The method of  claim 1 , further comprising:
 generating the prompt further based on a prompt template, the prompt template including an input which, when executed by the LLM, outputs any one of: an incident title, an incident summary, a root cause analysis, a root cause reasoning, and a combination thereof.   
     
     
         5 . The method of  claim 4 , further comprising:
 generating the incident title, the incident summary, the root cause analysis, and root cause reasoning, utilizing a first LLM; and   generating a summarized: incident title, incident summary, root cause analysis, root cause reasoning, and a combination thereof, utilizing a second LLM.   
     
     
         6 . The method of  claim 5 , wherein the first LLM includes a first context length, and the second LLM includes a second context length. 
     
     
         7 . The method of  claim 4 , further comprising:
 generating the prompt for the root cause analysis based on any one of: a generated incident summary, the correlated group of event records, and a combination thereof.   
     
     
         8 . The method of  claim 4 , further comprising:
 generating the prompt for the root cause reasoning based on: a root cause analysis, an incident summary, the correlated group of event records, and a combination thereof.   
     
     
         9 . The method of  claim 1 , wherein the predetermined data field is a tag. 
     
     
         10 . A system for reducing data record processing in incident report generation comprising:
 a processing circuitry;   a memory, the memory containing instructions that, when executed by the processing circuitry, configure the system to:   access a plurality of event records, each event record generated based on an event in a computing environment;   parse each event record based on a predetermined data field;   extract from each predetermined data field a data value;   correlate a group of event records of the plurality of event records based on at least an extracted data value;   generate an incident data record based on the extracted data values of the correlated group of event records;   generate a prompt based on the incident data record; and   generate an incident report by configuring a large language model (LLM) to execute the generated prompt.   
     
     
         11 . The system of  claim 10 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:
 generate the prompt further based on the incident data record and context data of a data source, wherein the data source generated a portion of the correlated group of event records.   
     
     
         12 . The system of  claim 10 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:
 store in the incident data record only the extracted data values of the correlated group of event records.   
     
     
         13 . The system of  claim 10 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:
 generate the prompt further based on a prompt template, the prompt template including an input which, when executed by the LLM, outputs any one of:   an incident title, an incident summary, a root cause analysis, a root cause reason, and a combination thereof.   
     
     
         14 . The system of  claim 13 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:
 generate the incident title, the incident summary, the root cause analysis, and root cause reasoning, utilizing a first LLM; and   generate a summarized:   incident title, incident summary, root cause analysis, root cause reason, and a combination thereof, utilizing a second LLM.   
     
     
         15 . The system of  claim 14 , wherein the first LLM includes a first context length, and the second LLM includes a second context length. 
     
     
         16 . The system of  claim 13 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:
 generate the prompt for the root cause analysis based on any one of:   a generated incident summary, the correlated group of event records, and a combination thereof.   
     
     
         17 . The system of  claim 13 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:
 generate the prompt for the root cause reasoning based on:   a root cause analysis, an incident summary, the correlated group of event records, and a combination thereof.   
     
     
         18 . The system of  claim 10 , wherein the predetermined data field is a tag. 
     
     
         19 . A non-transitory computer-readable medium storing a set of instructions for reducing data record processing in incident report generation, the set of instructions comprising:
 one or more instructions that, when executed by one or more processors of a device, cause the device to:
 access a plurality of event records, each event record generated based on an event in a computing environment; 
 parse each event record based on a predetermined data field; 
 extract from each predetermined data field a data value; 
 correlate a group of event records of the plurality of event records based on at least an extracted data value; 
 generate an incident data record based on the extracted data values of the correlated group of event records; 
 generate a prompt based on the incident data record; and 
 generate an incident report by configuring a large language model (LLM) to execute the generated prompt.